ClawHub
Back to skill

Security audit

Whisper Transcribe

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local wrapper for transcribing user-selected audio files with Whisper, with a minor dependency-pinning caution.

Install the Whisper dependency in a virtual environment and avoid using sudo. For stricter supply-chain control, pin openai-whisper and its dependencies before use, and remember that transcription will create local output files near the source audio or in the chosen output directory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:44
Finding

Unpinned Python Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 44
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

markdown
- `whisper` CLI (`pip install openai-whisper`)

Technical Analysis

The installation guidance instructs users to install openai-whisper without pinning a reviewed version or verifying package hashes. Consequently, the installed package and its transitive dependencies can change after the Skill has been audited.

Although the script does not install this dependency automatically, users following the documented setup procedure may download and execute package-controlled installation or runtime code. Exploitation requires compromise of the upstream package, one of its dependencies, or the package distribution channel; no such compromise is present in the audited project itself.

Attack Path

  1. An attacker compromises a future openai-whisper release, one of its transitive dependencies, or the relevant package distribution path.
  2. A user follows the documented pip install openai-whisper instruction.
  3. pip resolves and downloads the mutable package version and dependencies without integrity verification.
  4. Malicious build, installation, import, or runtime code executes under the installing or transcription user's account.
  5. The malicious dependency can access resources available to that account while installation or transcription is running.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip or the whisper command. Potential scope includes reading or modifying user-accessible files, accessing audio submitted for transcription, using available credentials, and making network requests. System-wide impact would be possible if installation is performed with elevated privileges. The practical likelihood is reduced because exploitation depends on an external supply-ch ...[truncated 46 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin openai-whisper to a specifically reviewed version rather than installing an unconstrained latest release.
  • Provide a locked requirements file containing exact versions for direct and transitive dependencies.
  • Record and enforce artifact hashes using pip install --require-hashes -r requirements.txt.
  • Install the dependency in a dedicated virtual environment or other isolated, least-privileged environment.
  • Advise users not to run package installation with sudo or an administrative account.
  • Establish a controlled dependency-update process that reviews release changes and regenerates the lock file and hashes before upgrades.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.